Behavioral task
behavioral1
Sample
3a27827f630fa24c8c3a3ae1bf1a58b5_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3a27827f630fa24c8c3a3ae1bf1a58b5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a27827f630fa24c8c3a3ae1bf1a58b5_JaffaCakes118
-
Size
727KB
-
MD5
3a27827f630fa24c8c3a3ae1bf1a58b5
-
SHA1
4e7fea9fa251470aef828df6fc75c18634788242
-
SHA256
d38beb671530957cc90f0114d7afcbecfef36a24392f80efb9601b4b2605f9e4
-
SHA512
3cbad744d485bf37fd412b0dde50856df9b79d187f16a4180c2c3b6fbadaf871e612bd0c82e7171e356fcb7fa36df7d5af51c0b16605ea0a91c9a74c31355f07
-
SSDEEP
12288:n2omG16jnMF75XIX4CeChbVIFZ+o52QMVpwY1YeIsQTMKM13varYpQBBzDc0WgqU:n1Ae754yibVHo52QM8YeeIsLKOvnpQBm
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a27827f630fa24c8c3a3ae1bf1a58b5_JaffaCakes118
Files
-
3a27827f630fa24c8c3a3ae1bf1a58b5_JaffaCakes118.exe windows:5 windows x86 arch:x86
373324a8466e4df7b7dc227b46f635af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ImageList_Destroy
msimg32
TransparentBlt
crypt32
CryptUnprotectData
wininet
InternetReadFile
version
VerQueryValueW
rpcrt4
RpcStringFreeW
urlmon
URLDownloadToCacheFileW
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenu
gdi32
DeleteObject
comdlg32
GetSaveFileNameW
advapi32
FreeSid
shell32
ShellExecuteW
Sections
.text Size: - Virtual size: 293KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 386KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.UPX2 Size: 685KB - Virtual size: 684KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ